Update metcalfc/changelog-generator action to v5 - #50
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v4.6.2→v5.0.1Release Notes
metcalfc/changelog-generator (metcalfc/changelog-generator)
v5.0.1Compare Source
5.0.1Base the changelog on the previous release of the same line, and assert it (#​479)fix: return the modified changelog as a real multiline output (#​478)v5.0.0Compare Source
Breaking change: commit subjects render as literal text
Every changelog line now wraps the commit subject in an inline-code span.
A commit subject is untrusted input. Anyone whose pull request you merge
chooses that text, and this action pastes it directly into your release notes.
Rendered as active Markdown, a subject could contribute links, images,
@mentions, issue references, raw HTML, or additional changelog entries to arelease it had no business editing. Rendering it as literal text closes that
off.
What this costs you. Subjects render monospace, and
#123,GH-123, barecommit SHAs, and
:emoji:inside a subject no longer autolink. BecauseGitHub's squash merge appends
(#​123)to the subject by default, most linesin a typical repository lose that link. The generated commit link at the start
of each line is unaffected. Control characters, line and paragraph separators,
and bidirectional-control characters are replaced with spaces, so a subject can
never span more than its own line.
No inputs or outputs changed, and the
No Changes.sentinel is unchanged.Staying on the previous format
v4.9.0
carries every security and dependency fix in this release -- including undici
7.29.0, which closes 12 advisories -- with the v4 output format untouched. Pin
metcalfc/changelog-generator@v4to stay there. Thev4tag will keep movingon the maintenance line.
What is in this release
Relative to v4.9.0, v5.0.0 adds only the escaping change. Both releases share
everything else:
bump:workflowrewriting pinned actions' provenance comments (#477)@vercel/ncc(#470),eslint(#472),globals(#471),codeql-action(#469)Full history: v4.8.0...v5.0.0
v5Compare Source
v4.9.1Compare Source
Patch release for the v4 line
Documentation and CI only.
dist/is byte-identical tov4.9.0,
so there is no functional change for consumers; this release exists so the
v4tag points at a commit whose docs are correct.
The README's "Simple output modifications" recipe percent-encoded newlines as
%0A, which the long-removed::set-outputcommand decoded.$GITHUB_OUTPUTdoes not, so anyone who copied that snippet got a single line with literal
%0Ain it. It now uses the heredoc form, with a random delimiter because thevalue is built from commit subjects.
The changelog output format remains unchanged from v4.8.0. See
v5.0.0
for the breaking change that renders commit subjects as literal text.
v4.9.0Compare Source
Maintenance release for the v4 line
Security and dependency fixes only. The changelog output format is unchanged
from v4.8.0 -- verified byte-identical -- so tracking
@v4is safe.the published bundle is now verified against a rebuild before attestation
@vercel/ncc0.45.0 and dev-dependency bumpsv5.0.0
contains these same fixes plus a breaking change: commit subjects render as
literal text, so a merged pull request's subject can no longer inject links or
mentions into your release notes. That change also stops
#123autolinkinginside subjects, which is why it is not on the v4 line.
v4.8.0Compare Source
Highlights
Failed changelog generation now fails the step
If the changelog could not be generated — an unresolvable ref, any git error — the action printed an
::error::annotation and then exited 0. The step went green,outputs.changelogwas never set, and downstream steps consumed an empty string without anything indicating a problem.It now exits non-zero.
fetch: trueno longer intermittently fails on shallow checkoutsThe default fetch path chained two
git fetch --depth=1calls ahead ofgit fetch --unshallow. Each rewrites.git/shallowwhile the next has already read it, so git would intermittently abort with:Because
fetch: trueis the default and the exit code was being discarded, this produced a silently empty changelog rather than a visible failure. It was happening in this repository's own CI.Now a single fetch, requesting
--unshallowonly when the checkout is actually shallow.Testing
make testpreviously rannpm test || echo "no tests available", wherenpm testwasexit 1— it reported success unconditionally. The project now has a real suite coveringchangelog.shagainst live git fixtures, ref validation, the release scripts, and the builtdist/bundle as the runner executes it. Both fixes above were found by adding it.Full changelog
v4.7.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.